Support for DNSSEC-validated lookups and TLSA RRsets.
Preliminary DANE support: per-destination trust-anchor digests.

Refactored internal verification callback machinery and re-implemented
fingerprint support via the new dane digest engine.

What remains now is to refactor smtp(8) to actually to DANE lookups
and built the appropriate policy structures on the fly.